@agentcomms/resend 0.18.1 → 0.19.0

package/README.md

@@ -29,6 +29,14 @@ approves, whatever the policy. The approval id is the request's `Idempotency-Key
 send whose outcome is unknown (`SEND_OUTCOME_UNKNOWN`) is never repeated, only checked, and a scheduled one is
 "accepted", never "sent", until Resend's own last event for it says so.
 
+**An agent's email says so in its From.** Prepare labels it `"Acme (agent)" <hello@acme.test>`: the name the From
+gave, or, for a bare address, the label name the person set in the core (its CLI's `label name`, or `comms_label`), then their word —
+`agent` unless they chose another ([design](../../docs/superpowers/specs/2026-10-15-agent-label-design.md), §6). With
+neither name, or a label over Resend's 100 characters, prepare refuses. `--as me` (`as: "me"` on
+`resend_send_prepare`) sends the From exactly as given, for when the person said so for that email; their label rules
+decide otherwise, and with none an email is labelled. The preview's first line says which, and the approval binds the
+whole From.
+
 **The key is typed by a person, at a terminal.** `agent-resend account add` reads it from a hidden prompt, or from
 `RESEND_API_KEY` in that terminal, and stores it in the system keychain. No MCP tool accepts a key: a key typed into
 a chat stays in the transcript.

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { A as removeAccountChange, At as updateGateAtTerminal, C as inspectKey, Ct as runUpdateCheckChild, D as policyChange, Dt as terminalUpdateHooks, E as policyApprovalRefusal, Ft as writeResult, G as SEND_LOOKUP, H as CommsError, Ht as VERSION, J as approvalsOf, K as UPDATE_CHECK_CHILD_COMMAND, Lt as RESEND_CALLER, M as showAccount, Nt as waitForApproval, O as policyReport, P as ResendContext, Pt as wholeNumber, R as checkNewName, S as addAccountChange, St as runCommand, T as modeOf, Tt as serverPruneChange, U as EXIT_CODES, V as CHANNEL_SERVERS, W as PATH_OPTIONS, X as approveRefusedHint, Y as approveChangeAtTerminal, Z as canPrompt, _ as showSentEmail, _t as refuseUnclaimedApproval, a as revokeSendApproval, at as exemptFromUpdateGate, bt as renderPrune, c as downloadReceived, ct as handoffSentence, d as listReceived, dt as kindOf, et as cliHandoffs, f as listScheduled, g as showReceived, gt as pathOverridesFromCliOptions, ht as paint, i as prepareSend, it as escapeForDisplay, j as sendPolicyOf, k as policyWanted, kt as truncateDisplay, l as getMetrics, lt as handoffSentenceToFill, m as listSuppressions, mt as openCore, n as executeSend, nt as commandPathOf, o as sendStatus, p as listSentEmails, q as agentMarker, r as finishSendApproval, rt as describeFenceReport, s as cancelScheduledChange, st as gatedChangeAtTerminal, t as beginSendApproval, tt as colorEnabled, u as listDomains, ut as installExitStatus, vt as renderApprovalWait, w as listAccounts, wt as serverInstallChange, x as runDoctor, xt as resolvePaths, yt as renderInstall } from "./send-BOMCKvLT.mjs";
+import { A as removeAccountChange, At as updateGateAtTerminal, C as inspectKey, Ct as runUpdateCheckChild, D as policyChange, Dt as terminalUpdateHooks, E as policyApprovalRefusal, Ft as writeResult, G as SEND_LOOKUP, H as CommsError, Ht as VERSION, J as approvalsOf, K as UPDATE_CHECK_CHILD_COMMAND, Lt as RESEND_CALLER, M as showAccount, Nt as waitForApproval, O as policyReport, P as ResendContext, Pt as wholeNumber, R as checkNewName, S as addAccountChange, St as runCommand, T as modeOf, Tt as serverPruneChange, U as EXIT_CODES, V as CHANNEL_SERVERS, W as PATH_OPTIONS, X as approveRefusedHint, Y as approveChangeAtTerminal, Z as canPrompt, _ as showSentEmail, _t as refuseUnclaimedApproval, a as revokeSendApproval, at as exemptFromUpdateGate, bt as renderPrune, c as downloadReceived, ct as handoffSentence, d as listReceived, dt as kindOf, et as cliHandoffs, f as listScheduled, g as showReceived, gt as pathOverridesFromCliOptions, ht as paint, i as prepareSend, it as escapeForDisplay, j as sendPolicyOf, k as policyWanted, kt as truncateDisplay, l as getMetrics, lt as handoffSentenceToFill, m as listSuppressions, mt as openCore, n as executeSend, nt as commandPathOf, o as sendStatus, p as listSentEmails, q as agentMarker, r as finishSendApproval, rt as describeFenceReport, s as cancelScheduledChange, st as gatedChangeAtTerminal, t as beginSendApproval, tt as colorEnabled, u as listDomains, ut as installExitStatus, vt as renderApprovalWait, w as listAccounts, wt as serverInstallChange, x as runDoctor, xt as resolvePaths, yt as renderInstall } from "./send-Ch-s9Q6H.mjs";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stripVTControlCharacters } from "node:util";
@@ -3407,7 +3407,7 @@ is out: update first, or put it off (the stop names both commands) · 64 usage
 		writeResult(result, output(), (data) => renderRead(data, options.color), streams);
 	}));
 	const send = program.command("send").description("prepare an email, and send it once a person has approved it");
-	accountOption(send.command("prepare")).description("build an email and show exactly what would go, to whom. Sends nothing").requiredOption("--from <address>", "the sender, at a verified domain: `Name <you@example.com>` or a bare address").requiredOption("--to <address>", "a recipient; repeat for more", collect, []).option("--cc <address>", "a copy recipient; repeat for more", collect, []).option("--bcc <address>", "a blind recipient; repeat for more — the preview lists every one", collect, []).requiredOption("--subject <subject>", "the subject").option("--text <text>", "the plain-text body").option("--html <html>", "an HTML body whose visible text is the text body; no images, forms or hidden parts").option("--attach <path>", "a file to attach, from an allowed folder; repeat for more", collect, []).option("--reply-to <address>", "where replies go; repeat for more", collect, []).option("--in-reply-to <messageId>", "the Message-ID this replies to, to keep the thread").option("--references <messageId>", "an earlier Message-ID in the thread; repeat for more", collect, []).option("--scheduled-at <time>", "send later: an ISO 8601 time with a zone, at most 30 days ahead").action(act(async (context, _options, flags) => {
+	accountOption(send.command("prepare")).description("build an email and show exactly what would go, to whom. Sends nothing").requiredOption("--from <address>", "the sender, at a verified domain: `Name <you@example.com>` or a bare address").requiredOption("--to <address>", "a recipient; repeat for more", collect, []).option("--cc <address>", "a copy recipient; repeat for more", collect, []).option("--bcc <address>", "a blind recipient; repeat for more — the preview lists every one", collect, []).requiredOption("--subject <subject>", "the subject").option("--text <text>", "the plain-text body").option("--html <html>", "an HTML body whose visible text is the text body; no images, forms or hidden parts").option("--attach <path>", "a file to attach, from an allowed folder; repeat for more", collect, []).option("--reply-to <address>", "where replies go; repeat for more", collect, []).option("--in-reply-to <messageId>", "the Message-ID this replies to, to keep the thread").option("--references <messageId>", "an earlier Message-ID in the thread; repeat for more", collect, []).option("--scheduled-at <time>", "send later: an ISO 8601 time with a zone, at most 30 days ahead").option("--as <who>", "who it appears to come from: agent (From labelled) or me (From as given, only when the person said so)").action(act(async (context, _options, flags) => {
 		const prepared = await prepareSend(context, String(flags.account), {
 			from: String(flags.from),
 			to: flags.to,
@@ -3420,7 +3420,8 @@ is out: update first, or put it off (the stop names both commands) · 64 usage
 			replyTo: flags.replyTo,
 			inReplyTo: flags.inReplyTo === void 0 ? void 0 : String(flags.inReplyTo),
 			references: flags.references,
-			scheduledAt: flags.scheduledAt === void 0 ? void 0 : String(flags.scheduledAt)
+			scheduledAt: flags.scheduledAt === void 0 ? void 0 : String(flags.scheduledAt),
+			as: flags.as === void 0 ? void 0 : String(flags.as)
 		});
 		writeResult(prepared, output(), renderPrepared, streams);
 	}));
@@ -3505,7 +3506,7 @@ is out: update first, or put it off (the stop names both commands) · 64 usage
 	}));
 	const mcp = program.command("mcp").description("run the MCP server on stdio, for a coding agent to connect to").option("--account <name>", "pin the server to one account; every tool then acts on it and no other").action(async (flags) => {
 		ran = true;
-		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-BfcIk24a.mjs")).startResendStdioServer;
+		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-FGuDOmop.mjs")).startResendStdioServer;
 		const core = coreForInvocation();
 		await startResendStdioServer({
 			...deps,

package/dist/index.d.mts

@@ -4322,7 +4322,8 @@ declare namespace external_d_exports {
   export { $brand, $input, $output, BRAND, CompileOptions, GlobalMeta, INVALID, Infer$1 as Infer, IssueData, JSONType, NEVER, $RefinementCtx as RefinementCtx, SafeExtendShape, Schema, TimePrecision, TypeOf, ZodAny, ZodArray, ZodBase64, ZodBase64URL, ZodBigInt, ZodBigIntFormat, ZodBoolean, ZodCIDRv4, ZodCIDRv6, ZodCUID, ZodCUID2, ZodCatch, ZodCodec, ZodCoercedBigInt, ZodCoercedBoolean, ZodCoercedDate, ZodCoercedNumber, ZodCoercedString, ZodCompileAsyncError, ZodCompileUnsupportedError, ZodCreditCard, ZodCustom, ZodCustomStringFormat, ZodDate, ZodDefault, ZodDiscriminatedUnion, ZodE164, ZodEmail, ZodEmoji, ZodEnum, ZodError, ZodErrorMap, ZodExactOptional, ZodFile, ZodFirstPartySchemaTypes, ZodFirstPartyTypeKind, ZodFlattenedError, ZodFloat32, ZodFloat64, ZodFormattedError, ZodFunction, ZodGUID, ZodIBAN, ZodIPv4, ZodIPv6, ZodISODate, ZodISODateTime, ZodISODuration, ZodISOTime, ZodInstanceOf, ZodInt, ZodInt32, ZodInt64, ZodIntersection, ZodIssue, ZodIssueCode, ZodJSONSchema, ZodJSONSchemaInternals, ZodJWT, ZodKSUID, ZodLazy, ZodLiteral, ZodMAC, ZodMap, ZodNaN, ZodNanoID, ZodNever, ZodNonOptional, ZodNull, ZodNullable, ZodNumber, ZodNumberFormat, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPreprocess, ZodPromise, ZodRawShape$1 as ZodRawShape, ZodReadonly, ZodRealError, ZodRecord, ZodSafeParseError, ZodSafeParseResult, ZodSafeParseSuccess, ZodSchema, ZodSet, ZodStandardSchemaWithJSON, ZodString, ZodStringFormat, ZodSuccess, ZodSymbol, ZodTemplateLiteral, ZodTransform, ZodTuple, ZodType, ZodTypeAny, ZodUInt32, ZodUInt64, ZodULID, ZodURL, ZodUUID, ZodUndefined, ZodUnion, ZodUnknown, ZodVoid, ZodXID, ZodXor, _ZodBigInt, _ZodBoolean, _ZodDate, _ZodNumber, _ZodString, _ZodType, _default, _function, any, array, base64, base64url, bigint$1 as bigint, boolean$1 as boolean, _catch as catch, check, cidrv4, cidrv6, clone, codec, coerce_d_exports as coerce, compile, config, index_d_exports$1 as core, creditCard, cuid, cuid2, currencyCode, custom, date$2 as date, decode, decodeAsync, deepPartial, describe, discriminatedUnion, e164, email, emoji, encode, encodeAsync, _endsWith as endsWith, _enum as enum, exactOptional, file, flattenError, float32, float64, formatError, fromJSONSchema, _function as function, getDiscriminatedOption, getErrorMap, globalRegistry, _gt as gt, _gte as gte, guid, hash, hex, hostname, httpUrl, iban, _includes as includes, output$1 as infer, inferFlattenedErrors, inferFormattedError, input, _instanceof as instanceof, int, int32, int64, intersection, invertCodec, ipv4, ipv6, iso_d_exports as iso, json, jwt, keyof, ksuid, lazy, _length as length, literal, index_d_exports$2 as locales, looseObject, looseRecord, _lowercase as lowercase, _lt as lt, _lte as lte, mac, map, _maxLength as maxLength, _maxSize as maxSize, memoizer, meta, _mime as mime, _minLength as minLength, _minSize as minSize, _multipleOf as multipleOf, nan, nanoid, nativeEnum, _negative as negative, never, _nonnegative as nonnegative, nonoptional, _nonpositive as nonpositive, _normalize as normalize, _null as null, nullable, nullish, number$1 as number, object, optional, output, _overwrite as overwrite, parse, parseAsync, partialRecord, pipe, _positive as positive, prefault, preprocess, prettifyError, promise, _properties as properties, _property as property, readonly, record, refine, _regex as regex, regexes_d_exports as regexes, registry, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync, set, setErrorMap, _size as size, _slugify as slugify, _startsWith as startsWith, strictObject, string$1 as string, stringFormat, stringbool, success, superRefine, symbol, templateLiteral, toJSONSchema, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, toZod, transform, treeifyError, _trim as trim, tuple, uint32, uint64, ulid, _undefined as undefined, union, unknown, _uppercase as uppercase, url, util_d_exports as util, uuid, uuidv4, uuidv6, uuidv7, validate, validateAsync, _void as void, withParser, xid, xor };
 }
 //#endregion
-//#region ../core/dist/change-flow-j65bYTxL.d.mts
+//#region ../core/dist/change-flow-DOyBTYin.d.mts
+//#endregion
 //#region src/config-hooks.d.ts
 /**
  * Test-only pauses inside `ConfigStore.convertToVersion3`, for the tests that prove a write racing the conversion is
@@ -4780,6 +4781,16 @@ interface ConfigBody {
   /** Superseded rotating credentials which still need conclusive per-token cleanup. */
   pendingRevocations?: PendingRevocation[] | undefined;
   defaults: Defaults;
+  /**
+   * How what an agent sends is labelled (design 2026-10-15-agent-label, L5): the word, the name, the rules that say
+   * who a message appears to come from, and each Slack account's agent emoji.
+   *
+   * `unknown` here, on purpose: it is read only through `agentLabelOf`, which reads a value it does not understand
+   * as the stricter one — an unknown word as `agent`, a rule list it cannot read as no rules — so a hand edit or a
+   * later release's key can only tighten. Kept through every write as the schemas keep every key they do not name, and
+   * judged by `classifyChange`.
+   */
+  agentLabel?: unknown;
 }
 interface ConfigV1 extends ConfigBody {
   version: 1;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { Bt as RESEND_DOWNLOAD_ORIGIN, Et as stripInvisible, H as CommsError, Ht as VERSION, It as PACKAGE_NAME, Lt as RESEND_CALLER, N as resendRequest, P as ResendContext, Rt as REFUSED, Vt as ROUTES, b as readBody, ft as neutralise, h as resendId, pt as newBoundary, v as addressesOf, y as attachmentRisks, z as keyPermissionOf, zt as RESEND_API_ORIGIN } from "./send-BOMCKvLT.mjs";
-import { t as createResendMcpServer } from "./server-CbcJL9CZ.mjs";
+import { Bt as RESEND_DOWNLOAD_ORIGIN, Et as stripInvisible, H as CommsError, Ht as VERSION, It as PACKAGE_NAME, Lt as RESEND_CALLER, N as resendRequest, P as ResendContext, Rt as REFUSED, Vt as ROUTES, b as readBody, ft as neutralise, h as resendId, pt as newBoundary, v as addressesOf, y as attachmentRisks, z as keyPermissionOf, zt as RESEND_API_ORIGIN } from "./send-Ch-s9Q6H.mjs";
+import { t as createResendMcpServer } from "./server-ERFs-XiT.mjs";
 //#region src/operations/events.ts
 const BODY_LIMIT = 2e4;
 const STATUS = /* @__PURE__ */ new Set([

package/dist/{send-BOMCKvLT.mjs → send-Ch-s9Q6H.mjs}

@@ -12,7 +12,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.18.1";
+const VERSION$1 = "0.19.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -201,7 +201,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-DvZxdFU_.mjs
+//#region ../core/dist/update-check-CVvpp5G8.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -1150,6 +1150,228 @@ var TaintCollector = class {
 		await store.record(this.#observations, exclusions, this.#handles);
 	}
 };
+/**
+* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
+* and the preview renderer (which makes them visible), so the two can never disagree.
+*/
+/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
+const INVISIBLE_RANGES = [
+	[173, 173],
+	[847, 847],
+	[1564, 1564],
+	[4447, 4448],
+	[6068, 6069],
+	[6155, 6159],
+	[8203, 8207],
+	[8232, 8233],
+	[8234, 8238],
+	[8288, 8292],
+	[8294, 8303],
+	[12644, 12644],
+	[65024, 65039],
+	[65279, 65279],
+	[65440, 65440],
+	[917504, 917631]
+];
+function isInvisible(codePoint) {
+	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
+	return false;
+}
+/**
+* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
+* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
+*/
+function isControl(codePoint) {
+	if (codePoint === 9 || codePoint === 10) return false;
+	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+}
+function isDangerous(codePoint) {
+	return isControl(codePoint) || isInvisible(codePoint);
+}
+/**
+* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
+* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
+*
+* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
+* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
+* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
+*/
+function stripInvisible(text) {
+	let removed = 0;
+	let out = "";
+	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
+	else out += char;
+	return {
+		text: out,
+		removed
+	};
+}
+/**
+* Labelling what an agent sends (design 2026-10-15-agent-label): the phrase `<name> (<word>)`, who a message appears to
+* come from, and which setting changes loosen that. Pure: nothing here reads the configuration or talks to a channel,
+* so every channel decides the same way from the same settings.
+*/
+/** L2: the words a label may use, exactly as written. Adding one is a code change with its own review. */
+const AGENT_LABEL_WORDS = Object.freeze([
+	"agent",
+	"assistant",
+	"twin",
+	"minion",
+	"bot",
+	"fake",
+	"AI"
+]);
+/** L4: the kinds of act a rule may name. Slack posts, replies, reacts, edits and shares files; mail sends and replies. */
+const ACT_KINDS = Object.freeze([
+	"post",
+	"reply",
+	"reaction",
+	"edit",
+	"file",
+	"send"
+]);
+/** L2's characters a name may not hold: parentheses would fake a second label, the rest break an address header. */
+const FORBIDDEN_NAME_CHARACTERS = /[()<>"@,;:\\]/u;
+function isAgentLabelWord(value) {
+	return typeof value === "string" && AGENT_LABEL_WORDS.includes(value);
+}
+/** Why a name cannot be labelled, or undefined when it can. */
+function nameProblem(name) {
+	if (name.length === 0) return "the name is empty";
+	if (name.trim() !== name) return "the name starts or ends with a space";
+	if (FORBIDDEN_NAME_CHARACTERS.test(name)) return "the name holds a parenthesis or one of <>\"@,;:\\";
+	for (const char of name) if (isDangerous(char.codePointAt(0) ?? 0)) return "the name holds a hidden or control character";
+}
+/** L1: `<name> (<word>)`, refused rather than cut short when it does not fit `limit` characters. */
+function labelPhrase(name, word, limit) {
+	const suffix = ` (${word})`;
+	const bare = name.endsWith(suffix) ? name.slice(0, -suffix.length) : name;
+	const problem = nameProblem(bare);
+	if (problem !== void 0) throw new CommsError("USAGE", `the label cannot be made: ${problem}`);
+	const phrase = `${bare}${suffix}`;
+	if ([...phrase].length > limit) throw new CommsError("USAGE", `the label "${phrase}" is longer than this platform's ${limit} characters`, { hint: "Set a shorter name with `label name`." });
+	return phrase;
+}
+/** L3's sentence for an unlabelled message, the first line of its preview. */
+const UNLABELLED_PREVIEW_LINE = "Sent as you, with no label: it will look as if you wrote it yourself";
+function addressMatches(pattern, address) {
+	const want = pattern.toLowerCase();
+	const got = address.toLowerCase();
+	return want.startsWith("@") ? got.endsWith(want) && got.indexOf("@") === got.length - want.length : got === want;
+}
+function ruleMatches(rule, query) {
+	if (rule.account !== query.account) return false;
+	if (rule.accountId !== void 0 && rule.accountId !== query.accountId) return false;
+	if (rule.kinds !== void 0 && !rule.kinds.includes(query.kind)) return false;
+	if (rule.conversation === void 0) return true;
+	if (query.slack !== void 0) return rule.conversation === query.slack.channel || rule.conversation === query.slack.dmWith;
+	if (query.mail !== void 0) {
+		const conversation = rule.conversation;
+		return query.mail.recipients.length > 0 && query.mail.recipients.every((address) => addressMatches(conversation, address));
+	}
+	return false;
+}
+/** L4: conversation and kinds, then conversation, then kinds, then the bare account rule. */
+function specificity(rule) {
+	return (rule.conversation === void 0 ? 0 : 2) + (rule.kinds === void 0 ? 0 : 1);
+}
+/** L3: the message, then the most specific matching rule (`agent` winning a tie), then the default `agent`. */
+function resolveIdentity(settings, query) {
+	if (query.requested !== void 0) return {
+		identity: query.requested,
+		source: "message"
+	};
+	let best;
+	for (const rule of settings?.rules ?? []) {
+		if (!ruleMatches(rule, query)) continue;
+		if (best === void 0 || specificity(rule) > specificity(best) || specificity(rule) === specificity(best) && rule.as === "agent") best = rule;
+	}
+	return best === void 0 ? {
+		identity: "agent",
+		source: "default"
+	} : {
+		identity: best.as,
+		source: "rule",
+		rule: best
+	};
+}
+const ruleKey = (rule) => JSON.stringify([
+	rule.account,
+	rule.accountId ?? null,
+	rule.conversation ?? null,
+	rule.kinds === void 0 ? null : [...rule.kinds].sort(),
+	rule.as
+]);
+/**
+* L5: the changes that need the person's confirmation — anything that could leave a message unlabelled or change how
+* the label looks. Adding an `agent` rule or removing a `me` rule tightens, and is not listed.
+*/
+function classifyAgentLabelChange(before, after) {
+	const changes = [];
+	const wordBefore = before?.word ?? "agent";
+	const wordAfter = after?.word ?? "agent";
+	if (wordBefore !== wordAfter) changes.push({
+		path: "agentLabel.word",
+		was: wordBefore,
+		now: wordAfter
+	});
+	if ((before?.name ?? null) !== (after?.name ?? null)) changes.push({
+		path: "agentLabel.name",
+		was: before?.name,
+		now: after?.name
+	});
+	const rulesBefore = new Map((before?.rules ?? []).map((rule) => [ruleKey(rule), rule]));
+	const rulesAfter = new Map((after?.rules ?? []).map((rule) => [ruleKey(rule), rule]));
+	const meAdded = [...rulesAfter].some(([key, rule]) => rule.as === "me" && !rulesBefore.has(key));
+	const agentRemoved = [...rulesBefore].some(([key, rule]) => rule.as === "agent" && !rulesAfter.has(key));
+	if (meAdded || agentRemoved) changes.push({
+		path: "agentLabel.rules",
+		was: before?.rules ?? [],
+		now: after?.rules ?? []
+	});
+	if (JSON.stringify(sorted(before?.slackIcons)) !== JSON.stringify(sorted(after?.slackIcons))) changes.push({
+		path: "agentLabel.slackIcons",
+		was: before?.slackIcons ?? {},
+		now: after?.slackIcons ?? {}
+	});
+	return changes;
+}
+function sorted(record) {
+	return Object.entries(record ?? {}).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
+const EMOJI_NAME = /^:[a-z0-9_+'-]{1,100}:$/u;
+function isRule(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rule = value;
+	if (typeof rule.account !== "string" || rule.account.length === 0) return false;
+	if (rule.as !== "agent" && rule.as !== "me") return false;
+	if (rule.accountId !== void 0 && (typeof rule.accountId !== "string" || rule.accountId.length === 0)) return false;
+	if (rule.conversation !== void 0 && (typeof rule.conversation !== "string" || rule.conversation.length === 0)) return false;
+	if (rule.kinds !== void 0 && !(Array.isArray(rule.kinds) && rule.kinds.length > 0 && rule.kinds.every((kind) => ACT_KINDS.includes(kind)))) return false;
+	return true;
+}
+/**
+* The stored `agentLabel`, read so that a bad value can only tighten. An unknown word reads as `agent`, an invalid
+* name as no name, and a rule list with any invalid rule is ignored whole: dropping one `agent` rule could leave a
+* broader `me` rule in charge. A malformed icon entry is dropped, falling back to the plain photo.
+*/
+function readAgentLabelSettings(raw) {
+	if (typeof raw !== "object" || raw === null) return {};
+	const stored = raw;
+	const settings = {};
+	if (isAgentLabelWord(stored.word)) settings.word = stored.word;
+	if (typeof stored.name === "string" && nameProblem(stored.name) === void 0) settings.name = stored.name;
+	if (Array.isArray(stored.rules) && stored.rules.every(isRule)) settings.rules = stored.rules.map((rule) => ({ ...rule }));
+	if (typeof stored.slackIcons === "object" && stored.slackIcons !== null) {
+		const icons = Object.entries(stored.slackIcons).filter((entry) => typeof entry[1] === "string" && EMOJI_NAME.test(entry[1]));
+		if (icons.length > 0) settings.slackIcons = Object.fromEntries(icons);
+	}
+	return settings;
+}
+/** The person's label settings from a loaded configuration, read as `readAgentLabelSettings` reads them. */
+function agentLabelOf(config) {
+	return readAgentLabelSettings(config.agentLabel);
+}
 /** Every first-party channel, the core first: what core knows about each without installing it. */
 const CHANNEL_SNAPSHOT = [
 	{
@@ -1319,7 +1541,11 @@ const CHANNEL_SNAPSHOT = [
 				word: "slack",
 				can: "post to Slack"
 			},
-			hosts: ["slack.com", "files.slack.com"],
+			hosts: [
+				"slack.com",
+				"files.slack.com",
+				"avatars.slack-edge.com"
+			],
 			approve: "agent-slack approve",
 			skills: {
 				prefix: "slack-",
@@ -3237,6 +3463,67 @@ function commandLinePackage(command, args) {
 	const line = [command, ...withoutPathOptions(args).words].join(" ");
 	return /(@[\w.-]+\/[\w.-]+|(?<=\s)[\w.-]+-mcp)(?=@|\s|$)/.exec(line)?.[1];
 }
+/**
+* The environment a child process is started with: `env` as it is, and on Windows also
+* `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
+* program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
+* when `PATH` says to.
+*/
+function childEnvironment(env = process.env, platform = process.platform) {
+	if (platform !== "win32") return env;
+	return {
+		...env,
+		NoDefaultCurrentDirectoryInExePath: "1"
+	};
+}
+/**
+* The directories of a search path that name a folder on their own: absolute, and on Windows on a drive. An empty
+* entry means the current folder to a Unix shell, and a relative one is read against it; either would make the program
+* found — and run — depend on where this was started, which is where a download may have saved a stranger's file.
+*/
+function absoluteSearchPath(entries, platform = process.platform) {
+	return entries.filter((entry) => platform === "win32" ? /^[A-Za-z]:[\\/]/.test(entry) : entry !== "" && path.posix.isAbsolute(entry));
+}
+/** This Node's real file, or its path as reported when that cannot be resolved. */
+function realFile(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/** Two real paths are one file: compared without case on Windows, whose paths are. */
+function sameRealPath(a, b, platform) {
+	return platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+/** The names `node` is found by in one folder of PATH, as a shell finds it: with each PATHEXT extension on Windows. */
+function nodeNames(env, platform) {
+	if (platform !== "win32") return ["node"];
+	return (env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";").filter(Boolean).map((extension) => `node${extension.toLowerCase()}`);
+}
+/**
+* The path a command names this Node by: the first `node` on `env`'s PATH that is the same real file as
+* `process.execPath`, as PATH spells it; otherwise `process.execPath`. With no `env`, nothing is looked for.
+*
+* Read when a command is located, as everything else in it is (D6): a link removed or repointed later is what the
+* command then meets. Only absolute folders of PATH are read, as the registrations' own search reads them.
+*/
+function nodeProgram(env, platform = process.platform) {
+	const own = process.execPath;
+	if (env === void 0) return own;
+	const real = realFile(own);
+	const search = env.PATH ?? env.Path ?? "";
+	for (const directory of absoluteSearchPath(search.split(delimiter), platform)) for (const name of nodeNames(env, platform)) {
+		const candidate = join(directory, name);
+		try {
+			if (!statSync(candidate).isFile()) continue;
+			accessSync(candidate, constants$1.X_OK);
+			if (!sameRealPath(realpathSync(candidate), real, platform)) continue;
+			return sameRealPath(candidate, own, platform) ? own : candidate;
+		} catch {}
+	}
+	return own;
+}
 const RECEIPT_VERSION = 1;
 const RECEIPT_FILE = "managed-shims.json";
 const MUTATION_LOCK_FILE = "managed-shims.lock";
@@ -3574,27 +3861,6 @@ async function removeManagedShimsForRuntimes(context, runtimes, options = {}) {
 		};
 	});
 }
-/**
-* The environment a child process is started with: `env` as it is, and on Windows also
-* `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
-* program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
-* when `PATH` says to.
-*/
-function childEnvironment(env = process.env, platform = process.platform) {
-	if (platform !== "win32") return env;
-	return {
-		...env,
-		NoDefaultCurrentDirectoryInExePath: "1"
-	};
-}
-/**
-* The directories of a search path that name a folder on their own: absolute, and on Windows on a drive. An empty
-* entry means the current folder to a Unix shell, and a relative one is read against it; either would make the program
-* found — and run — depend on where this was started, which is where a download may have saved a stranger's file.
-*/
-function absoluteSearchPath(entries, platform = process.platform) {
-	return entries.filter((entry) => platform === "win32" ? /^[A-Za-z]:[\\/]/.test(entry) : entry !== "" && path.posix.isAbsolute(entry));
-}
 /** The install options that pin a server to one account: the generic one, and Gmail's and Slack's own names. */
 const PIN_OPTIONS = Object.freeze([
 	"account",
@@ -5192,62 +5458,6 @@ const CONVERSION_HOOKS = Symbol("agentcomms.configConversionHooks");
 * by path can name.
 */
 const SEND_POLICY_HOOKS = Symbol("agentcomms.sendPolicyHooks");
-/**
-* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
-* and the preview renderer (which makes them visible), so the two can never disagree.
-*/
-/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
-const INVISIBLE_RANGES = [
-	[173, 173],
-	[847, 847],
-	[1564, 1564],
-	[4447, 4448],
-	[6068, 6069],
-	[6155, 6159],
-	[8203, 8207],
-	[8232, 8233],
-	[8234, 8238],
-	[8288, 8292],
-	[8294, 8303],
-	[12644, 12644],
-	[65024, 65039],
-	[65279, 65279],
-	[65440, 65440],
-	[917504, 917631]
-];
-function isInvisible(codePoint) {
-	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
-	return false;
-}
-/**
-* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
-* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
-*/
-function isControl(codePoint) {
-	if (codePoint === 9 || codePoint === 10) return false;
-	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
-}
-function isDangerous(codePoint) {
-	return isControl(codePoint) || isInvisible(codePoint);
-}
-/**
-* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
-* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
-*
-* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
-* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
-* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
-*/
-function stripInvisible(text) {
-	let removed = 0;
-	let out = "";
-	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
-	else out += char;
-	return {
-		text: out,
-		removed
-	};
-}
 const WINDOWS_RESERVED$1 = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9¹²³]|lpt[0-9¹²³])$/i;
 const UNSAFE_FILENAME_CHARS = /[/\\\u0000-\u001f\u007f<>:"|?*]/g;
 /** Truncates a string to at most `maxBytes` UTF-8 bytes without splitting a code point. */
@@ -6586,11 +6796,39 @@ function classifyChange(before, after) {
 	if (before.secrets === void 0 && after.secrets !== void 0 && after.secrets.store !== "keychain") {
 		if (holdsSecrets(before)) loosen("secrets.store", secretsStoreOf(before), after.secrets.store);
 	}
+	for (const loosening of classifyAgentLabelChange(agentLabelOf(before), agentLabelOf(after))) loosen(loosening.path, labelSettingValue(loosening, loosening.was), labelSettingValue(loosening, loosening.now));
 	return {
 		loosened: changes.map((change) => change.path),
 		changes
 	};
 }
+/**
+* One label rule in words, as a preview lists it: `acme/slack in C0ACME for post/reply: me`. No comma inside, since a
+* preview joins a list of them with commas.
+*/
+function agentLabelRuleText(rule) {
+	const where = rule.conversation === void 0 ? "" : ` in ${rule.conversation}`;
+	const kinds = rule.kinds === void 0 ? "" : ` for ${rule.kinds.join("/")}`;
+	return `${rule.account}${where}${kinds}: ${rule.as}`;
+}
+/** A label setting's value as a loosening carries it: the rules in words, the icons as they are, the rest as text. */
+function labelSettingValue(loosening, value) {
+	if (value === void 0 || value === null) return void 0;
+	if (loosening.path === "agentLabel.rules") return value.map(agentLabelRuleText);
+	if (loosening.path === "agentLabel.slackIcons") return { ...value };
+	return String(value);
+}
+/** The label settings a change can write, as the file holds them — raw, as `changedSettings` records every setting. */
+const LABEL_SETTINGS = [
+	"word",
+	"name",
+	"rules",
+	"slackIcons"
+];
+function storedAgentLabel(config) {
+	const stored = config.agentLabel;
+	return typeof stored === "object" && stored !== null && !Array.isArray(stored) ? stored : {};
+}
 /** The settings of a mailbox, and of an account, that a change can write — the ones the classifier judges. */
 const INBOX_SETTINGS = [
 	"sendPolicy",
@@ -6604,7 +6842,7 @@ const ACCOUNT_SETTINGS = [
 ];
 /**
 * Every setting that differs between `before` and `after`, loosened or tightened: the defaults, the secret store,
-* and each mailbox's and account's own settings — including those of one added or removed.
+* the agent label's settings, and each mailbox's and account's own settings — including those of one added or removed.
 *
 * What a change approval binds, beside its loosenings. A preview shows the whole change — "sends approved by never;
 * changes approved by chat" — and binding only the loosenings let a claim drop the tightening a person read, since
@@ -6642,6 +6880,9 @@ function changedSettings(before, after) {
 	const defaultsAfter = after.defaults;
 	for (const key of [.../* @__PURE__ */ new Set([...Object.keys(defaultsBefore), ...Object.keys(defaultsAfter)])].sort()) record(`defaults.${key}`, defaultsBefore[key], defaultsAfter[key]);
 	record("secrets.store", before.secrets?.store, after.secrets?.store);
+	const labelBefore = storedAgentLabel(before);
+	const labelAfter = storedAgentLabel(after);
+	for (const key of LABEL_SETTINGS) record(`agentLabel.${key}`, labelBefore[key], labelAfter[key]);
 	return changes;
 }
 /**
@@ -10090,7 +10331,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.18.1";
+const VERSION = "0.19.0";
 /**
 * Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
 * to decide whether the release it last heard of is newer than the one running.
@@ -10268,8 +10509,10 @@ const CHANNEL_PACKAGES = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manif
 /**
 * Locates the command that runs `request.target`'s CLI with `request.words`, or says why there is none.
 *
-* The program is always this process's Node (`process.execPath`), which must satisfy the target's `engines.node`; no
-* interpreter named anywhere else is run, or asked its version. A TypeScript entry gets `--experimental-strip-types`,
+* The program is always this process's Node, which must satisfy the target's `engines.node`; no interpreter named
+* anywhere else is run, or asked its version. It is named as PATH finds it — the first `node` on `request.env`'s PATH
+* that is the same real file as `process.execPath` — and otherwise by `process.execPath` (CUE-492): the real file only
+* identifies it, and `process.version` is that file's. A TypeScript entry gets `--experimental-strip-types`,
 * which Node 22.12–22.17 needs, and `--experimental-transform-types` only when this source run was started with it;
 * no other flag this process was started with is carried — debug, preload, condition and memory flags are not what the
 * CLI needs. The suite directories the command uses go between the entry and its words, one canonical option each,
@@ -10310,6 +10553,7 @@ function locateCliCommand(request, runtime = {
 		return fail("caller", `${nearest.root} cannot be resolved`);
 	}
 	if (!isAbsolute(process.execPath)) return fail("interpreter", `this Node, ${process.execPath}, is not a full path`);
+	const program = nodeProgram(request.env);
 	const pins = {};
 	for (const key of request.uses) pins[key] = request.paths[key];
 	let words;
@@ -10318,7 +10562,7 @@ function locateCliCommand(request, runtime = {
 	} catch (error) {
 		return fail("arguments", error instanceof Error ? error.message : String(error));
 	}
-	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform);
+	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform, program);
 	const located = (built, found, direction) => Object.freeze({
 		ok: true,
 		command: built.command,
@@ -10458,7 +10702,7 @@ function locateCliCommand(request, runtime = {
 * Checks what was found and makes its command: the target's Node range against this Node, then the entry — the source
 * CLI or the manifest's bin for the command it declares — as a readable file inside its package.
 */
-function buildCommand(target, found, words, runtime, callerSource, platform) {
+function buildCommand(target, found, words, runtime, callerSource, platform, program) {
 	const engines = found.manifest.engines;
 	const range = typeof engines === "object" && engines !== null ? engines.node : void 0;
 	if (typeof range !== "string") return {
@@ -10495,7 +10739,7 @@ function buildCommand(target, found, words, runtime, callerSource, platform) {
 	return {
 		ok: true,
 		command: new PrintedCommand(GATE, [
-			process.execPath,
+			program,
 			...flags,
 			checked.path,
 			...words
@@ -10799,7 +11043,8 @@ function cliHandoffs(options) {
 			uses: usesOf(use),
 			paths,
 			platform,
-			...registrations === void 0 ? {} : { registrations }
+			...registrations === void 0 ? {} : { registrations },
+			...options.env === void 0 ? {} : { env: options.env }
 		}, ...options.runtime === void 0 ? [] : [options.runtime]);
 		return result.ok ? result.command : result;
 	};
@@ -11441,7 +11686,11 @@ const SETTING_LABELS = {
 	"defaults.downloadsDir": "downloads folder",
 	"defaults.confirm.elicitationClients": "clients trusted to ask for a send approval",
 	"defaults.updateCheck": "daily update check",
-	"secrets.store": "where credentials are kept"
+	"secrets.store": "where credentials are kept",
+	"agentLabel.word": "the word after your name in the agent label",
+	"agentLabel.name": "the name in the agent label",
+	"agentLabel.rules": "who each kind of message appears to come from",
+	"agentLabel.slackIcons": "the icon of the agent’s Slack posts"
 };
 /**
 * What the loosening means for the person, in their terms.
@@ -11466,6 +11715,10 @@ function meaning(field, after, scope) {
 		case "defaults.confirm.elicitationClients": return "these clients may ask you to approve a send in their own window";
 		case "defaults.updateCheck": return "nothing on this machine will ask npm for a newer release, or stop until one is installed";
 		case "secrets.store": return "credentials will move out of the system keychain into files on this disk";
+		case "agentLabel.word": return "what an agent sends will carry this word after your name";
+		case "agentLabel.name": return after === null ? "where a channel has no name of its own for you, an agent’s message will be refused until a name is set" : "where a channel has no name of its own for you, what an agent sends will carry this name";
+		case "agentLabel.rules": return "what a rule sends as `me` goes out as you, with no label: it will look as if you wrote it yourself";
+		case "agentLabel.slackIcons": return "the app’s Slack posts will show this icon beside your name";
 		default: return "";
 	}
 }
@@ -12814,7 +13067,8 @@ async function withManagedShim(context, product, installed) {
 				...context.core.paths,
 				downloadsDir: context.core.paths.dataDir
 			},
-			platform: context.platform
+			platform: context.platform,
+			env: context.env
 		});
 		if (!located.ok) throw new CommsError("CONFIG", `the managed CLI command could not be located: ${located.message}`);
 		shim = await (context.writeShim ?? writeManagedShim)(shimContext, {
@@ -12877,7 +13131,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: serverFacts(request.channel).packageName,
-		version: "0.18.1"
+		version: "0.19.0"
 	};
 	const product = {
 		packageName,
@@ -14611,7 +14865,7 @@ function terminalUpdateHooks(core, env, options) {
 	};
 }
 //#endregion
-//#region ../core/dist/tool-arguments-DLa_xsSp.mjs
+//#region ../core/dist/tool-arguments-BkdTZEb8.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -27012,16 +27266,34 @@ function parseFrom(raw) {
 	if (!angled) return {
 		from: fromAddress,
 		fromAddress,
-		fromDomain
+		fromDomain,
+		name: ""
 	};
 	const name = headerText((angled[1] ?? "").trim().replace(/^"(.*)"$/, "$1"), "the From name", 100);
 	if (/[<>"@,;]/.test(name)) throw bad("the From name may not contain < > \" @ , or ;");
 	return {
 		from: name ? `${name} <${fromAddress}>` : fromAddress,
 		fromAddress,
-		fromDomain
+		fromDomain,
+		name
 	};
 }
+/**
+* The From an agent's send carries (design 2026-10-15-agent-label, R1): L1's phrase, quoted — unquoted, `(agent)` is
+* an RFC 5322 comment, which a mail client may drop — then the address. `parseFrom` never writes a quote, so a quoted
+* From is always one this package labelled.
+*/
+function labelledFrom(phrase, fromAddress) {
+	return `"${phrase}" <${fromAddress}>`;
+}
+/** Who a prepared From says the email comes from: the label this package wrote, with its phrase, or the person. */
+function identityOfFrom(from) {
+	const phrase = /^"(.+)" <[^<>]+>$/.exec(from)?.[1];
+	return phrase !== void 0 && AGENT_LABEL_WORDS.some((word) => phrase.endsWith(` (${word})`)) ? {
+		identity: "agent",
+		phrase
+	} : { identity: "me" };
+}
 /** A body: controls other than newline and tab are refused, invisible characters are counted for a warning. */
 function bodyText(value) {
 	const text = value.replace(/\r\n/g, "\n");
@@ -27081,7 +27353,7 @@ function linksInText(text) {
 /** Builds and checks the outbound message. Refuses anything an agent could not show a person in full. */
 async function buildMessage(input, options) {
 	const warnings = [];
-	const { from, fromAddress, fromDomain } = parseFrom(input.from);
+	const { from, fromAddress, fromDomain, name: fromName } = parseFrom(input.from);
 	const to = list(input.to, "to");
 	const cc = list(input.cc, "cc");
 	const bcc = list(input.bcc, "bcc");
@@ -27167,6 +27439,7 @@ async function buildMessage(input, options) {
 			references,
 			scheduledAt
 		},
+		fromName,
 		links,
 		warnings
 	};
@@ -28946,7 +29219,7 @@ function previewOf(options) {
 		...options.study.warnings,
 		...options.built.warnings
 	];
-	return renderMessagePreview({
+	const preview = {
 		recipients: {
 			from: message.from,
 			to: message.to,
@@ -28971,7 +29244,51 @@ function previewOf(options) {
 		links: options.built.links,
 		warnings,
 		policy: describePolicy(options.effective, options.approvalId, options.flags, options.handoffs)
-	});
+	};
+	return `${identityLine(identityOfFrom(message.from))}\n${renderMessagePreview(preview)}`;
+}
+/** L3: the first line of a preview — the label recipients will see, or that there is none. */
+function identityLine(identity) {
+	if (identity.identity === "me" || identity.phrase === void 0) return UNLABELLED_PREVIEW_LINE;
+	return `Sent as ${truncateDisplay(identity.phrase, 120)}: labelled in the From line, so whoever receives it can tell your agent sent it`;
+}
+/**
+* R1: who the email appears to come from, and its From. For `agent`, L1's phrase from the caller's From name, or the
+* core's `agentLabel.name` when the caller gave a bare address, refused when there is neither or it does not fit; for
+* `me`, the From as the caller gave it.
+*/
+function labelled(config, account, accountId, built, requested) {
+	if (requested !== void 0 && requested !== "agent" && requested !== "me") throw new CommsError("USAGE", `"${requested}" is not who an email appears to come from`, { hint: "Use agent or me." });
+	const settings = agentLabelOf(config);
+	if (resolveIdentity(settings, {
+		account,
+		accountId,
+		kind: "send",
+		requested,
+		mail: { recipients: uniqueRecipients(built.message) }
+	}).identity === "me") return {
+		message: built.message,
+		identity: "me"
+	};
+	const name = built.fromName !== "" ? built.fromName : settings.name;
+	if (name === void 0) throw new CommsError("USAGE", "this email is to be labelled as sent by your agent, and there is no name to label", { hint: "Give From a name, `Name <you@example.com>`, or set one with `label name`." });
+	let phrase;
+	try {
+		phrase = labelPhrase(name, settings.word ?? "agent", 100);
+	} catch (error) {
+		if (!(error instanceof CommsError) || error.hint !== void 0) throw error;
+		throw new CommsError(error.code, error.message, {
+			hint: "Give From a name the label can use, or set one with `label name` and give From a bare address.",
+			cause: error
+		});
+	}
+	return {
+		message: {
+			...built.message,
+			from: labelledFrom(phrase, built.message.fromAddress)
+		},
+		identity: "agent"
+	};
 }
 async function attachPolicy(context) {
 	const config = await context.config();
@@ -29000,11 +29317,17 @@ async function prepareSend(context, name, input) {
 		"--send",
 		"confirm"
 	]), (command) => `A person can change it with ${command}.`) });
-	const built = await buildMessage(input, {
+	const { as: requested, ...email } = input;
+	const composed = await buildMessage(email, {
 		now: context.now(),
 		attach: await attachPolicy(context)
 	});
-	const domainNote = await checkFromDomain(context, named, built.message.fromDomain);
+	const domainNote = await checkFromDomain(context, named, composed.message.fromDomain);
+	const { message: outbound, identity } = labelled(config, named.name, named.account.id, composed, requested);
+	const built = {
+		...composed,
+		message: outbound
+	};
 	const study = await studyRecipients(context, named, built.message, config.defaults.riskEscalation);
 	const requiredPolicy = study.flags.length > 0 ? "confirm" : "chat";
 	const effective = stricterPolicy(livePolicy, requiredPolicy);
@@ -29046,6 +29369,7 @@ async function prepareSend(context, name, input) {
 	return {
 		approvalId: record.approvalId,
 		account: name,
+		identity,
 		preview: previewOf({
 			name,
 			approvalId: record.approvalId,

package/dist/{server-CbcJL9CZ.mjs → server-ERFs-XiT.mjs}

@@ -1,4 +1,4 @@
-import { $ as checkForUpdates, A as removeAccountChange, B as strictToolArguments, D as policyChange, E as policyApprovalRefusal, F as CHANGE_POLICIES, G as SEND_LOOKUP, H as CommsError, Ht as VERSION, I as MODES, L as SEND_POLICIES, M as showAccount, Mt as waitCallOptions, Nt as waitForApproval, O as policyReport, Ot as toCommsError, P as ResendContext, Q as changeToolResult, _ as showSentEmail, _t as refuseUnclaimedApproval, c as downloadReceived, d as listReceived, f as listScheduled, g as showReceived, i as prepareSend, jt as updateToolGate, k as policyWanted, l as getMetrics, m as listSuppressions, n as executeSend, o as sendStatus, ot as gatedChange, p as listSentEmails, s as cancelScheduledChange, u as listDomains, w as listAccounts, x as runDoctor } from "./send-BOMCKvLT.mjs";
+import { $ as checkForUpdates, A as removeAccountChange, B as strictToolArguments, D as policyChange, E as policyApprovalRefusal, F as CHANGE_POLICIES, G as SEND_LOOKUP, H as CommsError, Ht as VERSION, I as MODES, L as SEND_POLICIES, M as showAccount, Mt as waitCallOptions, Nt as waitForApproval, O as policyReport, Ot as toCommsError, P as ResendContext, Q as changeToolResult, _ as showSentEmail, _t as refuseUnclaimedApproval, c as downloadReceived, d as listReceived, f as listScheduled, g as showReceived, i as prepareSend, jt as updateToolGate, k as policyWanted, l as getMetrics, m as listSuppressions, n as executeSend, o as sendStatus, ot as gatedChange, p as listSentEmails, s as cancelScheduledChange, u as listDomains, w as listAccounts, x as runDoctor } from "./send-Ch-s9Q6H.mjs";
 import { S as union, c as boolean, g as object, h as number, s as array, x as string } from "./iso-USuVU_sk.mjs";
 import { t as McpServer } from "./mcp-DIH4cS6P-CIWWZQbz.mjs";
 //#region src/mcp/server.ts
@@ -314,7 +314,7 @@ async function createResendMcpServer(options = {}) {
 	})));
 	server.registerTool("resend_send_prepare", {
 		title: "Prepare an email",
-		description: "Build an email and return the exact preview — every recipient, BCC included, the reach and the From domain — with an approval id. Nothing is sent. Show the preview in full and wait for the person’s yes.",
+		description: "Build an email and return the exact preview — every recipient, BCC included, the reach and the From domain — with an approval id. Nothing is sent. Its From is labelled `<name> (agent)` — the From’s name, or the person’s label name for a bare address — unless `as` is `me`, and the preview’s first line says which. Show the preview in full and wait for the person’s yes.",
 		inputSchema: {
 			...accountArg,
 			from: string().describe("the sender at a verified domain: `Name <you@example.com>` or a bare address"),
@@ -328,7 +328,8 @@ async function createResendMcpServer(options = {}) {
 			replyTo: array(string()).optional(),
 			inReplyTo: string().optional().describe("the Message-ID this replies to, to keep the thread"),
 			references: array(string()).optional(),
-			scheduledAt: string().optional().describe("send later: an ISO 8601 time with a zone, at most 30 days ahead")
+			scheduledAt: string().optional().describe("send later: an ISO 8601 time with a zone, at most 30 days ahead"),
+			as: string().min(1).optional().describe("who it appears to come from: agent (From labelled \"<name> (agent)\") or me (From as given). Pass `me` only when the person said so for this email; left out, their rules decide, and then agent")
 		},
 		annotations: {
 			readOnlyHint: false,

package/dist/{stdio-entry-BfcIk24a.mjs → stdio-entry-FGuDOmop.mjs}

@@ -1,4 +1,4 @@
-import { t as createResendMcpServer } from "./server-CbcJL9CZ.mjs";
+import { t as createResendMcpServer } from "./server-ERFs-XiT.mjs";
 //#region src/mcp/stdio-entry.ts
 /**
 * Starting the stdio server. On stdio, **stdout is the protocol**: one stray `console.log` corrupts the stream, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcomms/resend",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "Resend for coding agents: read domains, sent and received mail, metrics and suppressions, and send mail that nothing sends without a person's approval of exactly what goes out.",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "THIRD_PARTY_LICENSES"
   ],
   "dependencies": {
-    "@agentcomms/core": "0.18.1"
+    "@agentcomms/core": "0.19.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "2.1.0"
@@ -107,5 +107,5 @@
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --test --test-timeout=600000 \"test/**/*.test.ts\""
   },
-  "gitHead": "fc398edc67287e411f8c5cb821f434220cb83aa5"
+  "gitHead": "29a7121620a9ef305a4260f193c40db1980312bd"
 }